Skip to content

fix(metadata): keep each colliding item's own _packageId provenance (ADR-0048)#1822

Merged
xuyushun441-sys merged 1 commit into
mainfrom
fix/adr-0048-collision-packageid-provenance
Jun 13, 2026
Merged

fix(metadata): keep each colliding item's own _packageId provenance (ADR-0048)#1822
xuyushun441-sys merged 1 commit into
mainfrom
fix/adr-0048-collision-packageid-provenance

Conversation

@xuyushun441-sys

Copy link
Copy Markdown
Contributor

The bug

While verifying the ADR-0048 frontend audit, I found that dashboard/report/page prefer-local was actually broken for collisions — the ✅ in my audit was wrong.

When two installed packages ship an item of the same type/name, getMetaItem/getMetaItems grafted the artifact protection envelope from a first-match artifact lookup (lookupArtifactItem(type, name) with no package). So the second package's item inherited the first package's _packageId. Since the frontend prefer-local (preferLocal(list, name, app._packageId)) filters the unscoped list by _packageId, the mislabel made it resolve a collision to the wrong package — or miss the local item entirely.

(This is the list _packageId re-stamp anomaly I'd spotted during the docs verification but hadn't run down.)

Fix

  • getMetaItem scopes the artifact lookup to request.packageId.
  • getMetaItems scopes the per-item decorate to the requested package (scoped list) else to each item's own _packageId.
  • getItem ordering unchanged — a bare-key runtime/DB overlay still takes ADR-0005 precedence (clarifying comment only). An env-wide package-less overlay of a colliding name stays inherently ambiguous by schema (sys_metadata unique on type+name+org, not package); pure-artifact collisions (the marketplace default) now resolve correctly.

Verification

Live, real page collision (showcase showcase_task_workbench + a Studio-package page of the same name):

  • single ?package=com.objectstack.studio → Studio's page, _packageId: com.objectstack.studio; ?package=com.example.showcase → showcase's.
  • unscoped /meta/page list → both rows, each with its own correct _packageId.
  • Browser: /apps/com.objectstack.studio/page/showcase_task_workbench renders Studio's (empty) page; /apps/com.example.showcase/page/showcase_task_workbench renders the full Task Workbench. No console errors.

603 objectql tests green (added a list-collision provenance test; ADR-0005 overlay-precedence tests still pass).

🤖 Generated with Claude Code

…ADR-0048)

When two packages ship a same-name item, getMetaItem/getMetaItems grafted the
artifact protection envelope from a first-match lookup, so the second package's
item inherited the FIRST package's _packageId. The frontend prefer-local
(dashboard/report/page) filters the unscoped list by _packageId, so this
mislabel resolved collisions to the wrong package.

Scope the artifact lookup to the requested package (getMetaItem) and to each
item's own _packageId (getMetaItems list decorate). getItem ordering unchanged —
a bare-key overlay still takes ADR-0005 precedence.

Verified live (page collision showcase vs studio): single ?package=, the
unscoped list (both items, correct _packageId each), and the frontend page route
(/apps/<pkg>/page/showcase_task_workbench renders each package's own page). 603
objectql tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@vercel

vercel Bot commented Jun 13, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
spec Ready Ready Preview, Comment Jun 13, 2026 9:32pm

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation size/s tests tooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants